SHA256是否具有良好的跨平台支持？

Question

I'm currently designing a new REST API which I'm considering requiring message signing. At a high level the model is like this:

1. The API consumer is given an API Key and Secret
2. The API consumer uses the Secret to create a message digest HMAC of the message it sends into the API.

I've been considering using SHA256 for the signing, but want to be sure it will work with:

1. Android/Java
2. iOS
3. all other major platform, etc.

I realize SHA-1 has good support, but I really need to use something stronger, if possible.

Answer 1

SHA256 is supported by CommonCrypto in iOS. Java supports it via MessageDigest.getInstance("SHA-256") , Android as well (Java). And lets not forget Windows Phone where it's supported as well. That's pretty major in my opinion.

As you already pointed out you shouldn't use SHA1 as it's not secure enough anymore .

Answer 2

SHA-256withRSA is NOT supported in older android versions (verified the same in Android 4.0.3, 4.1.1). I have experienced this problem while using JSCEP. The digest algorithm returned by SCEP server is SHA-256. But SHA-256withRSA is not present in any default SecurityProviders in those android versions. Found a relevant link: Which versions of Android support which package signing algorithms?

This link shows that SHA-256withRSA was added later: https://android-review.googlesource.com/44360